Overview

If an exported service does not define android:permission with a proper protection level and performs or grants access to sensitive functionality, another third-party app outside the intended trust boundary can start or bind to it and invoke that functionality. See MASTG-KNOW-0133 for details on services, MASTG-KNOW-0017 for permissions and protection levels, and MASTG-KNOW-0020 for the IPC model of Android.

This test checks whether the app exposes sensitive functionality through exported and unprotected services.

Steps

  1. Use MASTG-TECH-0013 to reverse engineer the app.
  2. Use MASTG-TECH-0117 to obtain the AndroidManifest.xml.
  3. Use MASTG-TECH-0161 to list the exported services and their associated android:permission.
  4. Use MASTG-TECH-0014 to inspect the code of each exported service.

Observation

The output should contain a list of exported services and the relevant parts of their implementation, including the interface they expose and any permission checks they perform.

Evaluation

The test case fails if any exported service is not protected by an appropriate android:permission that restricts which apps can start or bind to it and exposes or performs sensitive functionality, for example by returning sensitive data, performing a security-relevant action, or allowing a caller to invoke a bound-service interface without authorization.

Further Validation Required:

Inspect each exported service using MASTG-TECH-0023 to determine whether it exposes sensitive functionality:

Then determine whether external access to the service is appropriately restricted for the functionality it exposes and the app's intended trust boundary:

Saincheisteanna nasctha

Naisc
is related to MASTG-BEST-0052 Restrict Access to Android App Components (Android)